<html>
<head><meta charset="utf-8"><title>Quantifying Rust&#x27;s safety · wg-secure-code · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/index.html">wg-secure-code</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Quantifying.20Rust&#x27;s.20safety.html">Quantifying Rust&#x27;s safety</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="187867969"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Quantifying%20Rust%27s%20safety/near/187867969" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Quantifying.20Rust&#x27;s.20safety.html#187867969">(Feb 10 2020 at 23:00)</a>:</h4>
<p>A question came up at work whether I can quantify the safety benefits of Rust and back them up with actual data. Turns out I can:<br>
<a href="https://www.reddit.com/r/rust/comments/f1ynel/quantitative_data_on_the_safety_of_rust/" target="_blank" title="https://www.reddit.com/r/rust/comments/f1ynel/quantitative_data_on_the_safety_of_rust/">https://www.reddit.com/r/rust/comments/f1ynel/quantitative_data_on_the_safety_of_rust/</a></p>



<a name="190669038"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Quantifying%20Rust%27s%20safety/near/190669038" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Vytautas Astrauskas [he/him] <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Quantifying.20Rust&#x27;s.20safety.html#190669038">(Mar 15 2020 at 21:59)</a>:</h4>
<p>I just found a related paper: <a href="https://arxiv.org/pdf/2003.03296.pdf" target="_blank" title="https://arxiv.org/pdf/2003.03296.pdf">https://arxiv.org/pdf/2003.03296.pdf</a></p>



<a name="190927528"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Quantifying%20Rust%27s%20safety/near/190927528" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Quantifying.20Rust&#x27;s.20safety.html#190927528">(Mar 18 2020 at 00:17)</a>:</h4>
<p>I feel conflicted about this paper. On one hand, the legwork is praise-worthy and the conclusions on ways to prevent this are super interesting. On the other, it makes some rather strong claims without backing them up - like "Such issues are very common in third-party Rust libraries." and states that Rust is no better at preventing memory safety issues than "other languages", which is not a conclusion you can derive from the data presented. The "Implication to Potential Users" section is much more correct but almost reads like it contradicts the rest of the paper.</p>



<a name="190932650"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Quantifying%20Rust%27s%20safety/near/190932650" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Vytautas Astrauskas [he/him] <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Quantifying.20Rust&#x27;s.20safety.html#190932650">(Mar 18 2020 at 02:02)</a>:</h4>
<blockquote>
<p>the conclusions on ways to prevent this are super interesting</p>
</blockquote>
<p>Are you referring mainly to section <em>5.3  Implication to Compiler Developers</em> or something else?</p>



<a name="190968361"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Quantifying%20Rust%27s%20safety/near/190968361" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Quantifying.20Rust&#x27;s.20safety.html#190968361">(Mar 18 2020 at 11:43)</a>:</h4>
<p>Mostly <em>5.2  Implication to Program Developers</em> because I don't understand <em>5.3  Implication to Compiler Developers</em> well enough to tell how feasible it is</p>



<a name="190990294"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Quantifying%20Rust%27s%20safety/near/190990294" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Vytautas Astrauskas [he/him] <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Quantifying.20Rust&#x27;s.20safety.html#190990294">(Mar 18 2020 at 14:47)</a>:</h4>
<p>I see.</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>